Tag Info

Hot answers tagged

14

Yes, bcrypt has a maximum password length. The original article contains this: the key argument is a secret encryption key, which can be a user-chosen password of up to 56 bytes (including a terminating zero byte when the key is an ASCII string). So one could infer a maximum input password length of 55 characters (not counting the terminating zero). ...


7

Edit: it so happens that the first version of the question was talking about Ken Thompson's classic essay, so my answer was about it, too. It would be a shame to delete it, so I leave it at the end. Now, for the "updated" question: we now speak of something completely different, which is about the easiness of "hiding a backdoor in plain sight", namely in ...


4

Yes, malware exists in all sorts of languages. Often, though, some of the most critical fiddly bits of many exploits are written not in C or C++, but rather directly in machine code, carefully assembled often by hand. This may be the only want to get the sizing and alignment correct for what you're trying to do. The distance from the "metal" is a matter of ...


3

If a user's browser is able to call (send HTTP request to) your Python scripts (with or without AJAX), then assume that an authenticated user will be able to send custom HTTP requests, including whatever variables (parameters) they want. Always assume that not only your users are able to see your JavaScript code, but they're also able to modify it, override ...


2

How can I implement secure connection between client and my python server? I guess I could use SSH or SSL, but which one will be better suited for the job? And If I choose SSH then wouldn't it interfere with SSH login service I use to manage my (whole) server? If it is only you that will be connecting to the server, I would secure the whole process ...


2

As you ouline, due to the limitaiton of /etc/shadow access, at some level, your application will either have to access that file or access some other module/service which has access to that file. There is no avoiding it if you want a solution which uses locally managed user credentials (unless you totally roll your own, which I strongly recommend avoiding). ...


2

You might want to take a look at the Canari Framework (https://www.canariproject.com/4-3-transform-development-quick-start/). It's an awesomely simple transform development framework that let's you do some pretty rad things ;). UPDATE 1: Canari now has some additional support for complex field types. So far we've added datetime, timespan, color, and date. ...


2

You have a Web site; it is meant to provide pages to whoever asks for them. That's the whole point of a Web site. What sense would it make to refuse to send the page to some people ? Especially if the exclusion criterion is the User-Agent string, which is freely chosen by the client. Any individual with nefarious intentions can masquerade his software so ...


2

The best way of dealing with this is to write a custom sqlmap tamper script. You can find examples in the tamper folder. In the script you'll want to make a request to whatever page is generating the random form parameter (or appending to a parameter's value); or if you can truly predict it every time, just have the tamper script generate it itself. So ...


2

Typically, you would just start the listener separately: Open a new terminal and run your nc -l -p 9999. Leave that there waiting, then fire off your exploit causing the remote machine to start a reverse shell. There are loads of things that can go wrong in this process, generally just binding a shell is much easier than getting a reverse shell to work when ...


2

As a rule of thumb, never trust user input, even if you're confident it'll only come from authenticated users. If any of your CGI scripts are internet-facing (i.e. can be executed as a direct consequence of your users requests, be them the jQuery ajax calls or regular page access), you should sanitize all input fields and check proper authentication and ...


2

The python script connects to the IP 82.94.242.254 on port 8123, authenticates using pass1 and pass2 and then start receiving commands from the C&C. The commands are DOWNLOAD, NIKTO, NMAP, PING, PINGFLOOD, SYNFLOOD and VERSION. Most of these will trigger the execution of a .sh script. From the names we can guess the kind of commands available, which are ...


2

In general there are valid URL schemes that are dangerous. Most obviously javascript:, which as a pseudo-URL refers not to a new location, but to a command to execute on the current page. Allowing a javascript: URL to be added to your page means you have a cross-site scripting problem. There are also other scripting aliases (vbscript:, mocha: et al), as ...


2

I don't think that the code you are marking is the one achieving to exploit the bug: s.send(struct.pack('>I',len(buff) )) What this line is doing is sending the length of the buffer he is going to send right behind in the proper endiannes (Big Endian or network endiannes). I believe that the exploit itself will have to do with the lengths of the ...


2

The Hearbleed security bug (CVE-2014-0160) affects only specific versions of OpenSSL, and nothing else. From OpenSSL Security Advisory [07 Apr 2014], on OpenSSL's web site: Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1. So, to answer your question: It depends on whether OpenSSL is used on your system, ...


2

You can write a virus in any language. The condition is the OS vulnerability that is being exploited and the language tools that are available to take advantage of it. "High-level" languages are not 'further' from the OS kernel, but rather they are more abstracted from the kernel from the programmer's point of view. Even Python can access network sockets, ...


1

I guess you are referring to ssltest.py that is circulating in the wild. The Client Hello was probably just copied from another packet capture. It is part of the SSL handshake: Client Server ClientHello --------> ServerHello ...


1

There are multiple benefits using https: More likely that firewalls will accept this traffic, rather than a random port. HTTPS encryption hides what is beeing sent over the network, so IDS/IPS systems will not see what is going on - given that there is no SSL termination (transparent). HTTPS will look more normal in firewall logs. It is not unexpected as ...


1

Why would you bother using a bufferoverflow when using Macros? It would be easier to just inject some VB script which does calls to, for instance, powershell (there is a really good exploitation framework here named PowerSploit). Exploits which do target bufferoverflows within Word, are a lot harder to find and exploit. If the target has EMET installed, ...


1

These books can be a good starting point: Violent Python: A Cookbook for Hackers, Forensic Analysts, Penetration Testers and Security Engineers Gray Hat Python: Python Programming for Hackers and Reverse Engineers


1

The PBKDF2 algorithm available from the passlib library will do the trick. It doesn't have some appealing properties of bcrypt such as being hard to speedup using GPUs but it is still a strong password hashing with a configurable iteration count.


1

If you want to write a crypter, usually you take a certain shellcode and then load it into a script which generates another shellcode which contains an encrypted form of your shellcode. At runtime the shellcode will then be decrypted and run. To generate this encrypted form you will need to either use an existing crypter or create your own. In your python ...


1

In this case, no it won't leak. What you're doing in Python here is simply making an HTTP request via a proxy that happens to be Tor's local SOCKS proxy. The response of this request will basically be some text. Regardless of the actual content of this response, your Python "client" will not actually parse the response or user plugins to run certain ...



Only top voted, non community-wiki answers of a minimum length are eligible